2KKUU7ita

154
Part III: Hacking Network Hosts
Detecting Common Router, Switch,
and Firewall Weaknesses
In addition to the more technical exploits that I cover in this chapter, some
high-level security vulnerabilities commonly found on network devices can
create many problems.
Finding unsecured interfaces
You want to ensure that HTTP and telnet interfaces to your routers, switches,
and firewall aren’t configured with a blank, default, or otherwise easy-toguess
password. This advice sounds like a no-brainer, but it’s for one of the
most common weaknesses. When a malicious insider or other attacker gains
access to your network devices, he owns the network. He can then lock out
administrative access, set up back-door user accounts, reconfigure ports,
and even bring down the entire network without you ever knowing.
I once found a simple password that a systems integrator had configured on a
Cisco ASA firewall and was able to log in to the firewall with full administrative
rights. Just imagine what could happen in this situation if someone with malicious
intent came across this password. Lesson learned: It’s the little things
that can get you. Know what your vendors are doing and keep an eye on them!
Another weakness is related to HTTP and telnet being enabled and used on
many network devices. Care to guess why this is a problem? Well, anyone
with some free tools and a few minutes of time can sniff the network and capture
login credentials for these systems when they’re being sent in cleartext.
When that happens, anything goes.
Exploiting IKE weaknesses
Businesses running a VPN on a router or firewall are common. If you fall into
this category, chances are good that your VPN is running the Internet Key
Exchange (IKE) protocol, which has a couple of well-known exploitable
weaknesses:
✓ It’s possible to crack IKE “aggressive mode” pre-shared keys using Cain
& Abel and the IKECrack tool (http://ikecrack.sourceforge.net).
✓ Some IKE configurations, such as those in certain Cisco PIX firewalls,
can be taken offline. All the attacker has to do is send 10 packets per
second at 122 bytes each and you have a DoS attack on your hands.